Publicado em 28 de ago.

[Resolvido!]Virtumonde

Galera o Spybot aqui em casa está acusando um tal de virtumonde e seus dll. já mandei remover, removi no registro e segui todos os passos que o SD manda, mas sempre q faço uma varredura ele reaparece. Como me livro desse?

Obrigado.

Log do Hijackthis:

Logfile of HijackThis v1.99.1

Scan saved at 11:19:04, on 28/8/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\Norton AntiVirus\navapsvc.exe

C:\Arquivos de programas\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Arquivos de programas\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccApp.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\BitLord\BitLord.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Documents and Settings\Caco\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Arquivos de programas\DAEMON Tools Toolbar\DTToolbar.dll

O3 - Toolbar: qalkfxor - {FA9CBCB5-3330-4AF1-A2A3-30FE4C366215} - C:\WINDOWS\qalkfxor.dll (file missing)

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Arquivos de programas\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1219543772266

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: ilwmmh.dll gsgxpz.dll

O21 - SSODL: pdoskegl - {7E97518F-E349-485F-8031-F9C2ACE5F5E2} - C:\WINDOWS\pdoskegl.dll (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Agendador do LiveUpdate automático - Symantec Corporation - C:\Arquivos de programas\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\ARQUIV~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

O23 - Service: Serviço do Auto-Protect do Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Arquivos de programas\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Arquivos de programas\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Arquivos de programas\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARQUIV~1\ARQUIV~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

Discussão (11)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

DigRam· 28 de ago.

Boa Tarde! Nemesys

<@> Abra o Spybot Search & Destroy!

<@> No menu superior,vá em Modo e selecione a opção Avançado. Confirme!

<@> Clique no botão Ferramentas e depois em Residente.

<@> Desmarque a opção: Ativar "TeaTimer" do Residente. ( *Proteção **geral** das configurações de sistema* )

--------------------------

<@> Faça o download do ComboFix.exe.

<@> Baixe-o para o Desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.Salve-a no desktop,renomeada como: Kombo.exe

Ps: Nomeie durante o salvamento,e não após salvá-la!

Ps: Caso ocorra alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança.

<@> Abrirá a janela Auto Scan. Aguarde!

<@> Digite a opção para continuar! >> Enter

<@> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado!

<@> Para parar ou sair do ComboFix,tecle "N".

----------------------

<@> Poste os relatórios: C:\ComboFix.txt + Log do HJT,atualizado.

Abraços!

Nemesys· 28 de ago.

Log do ComboFix:

ComboFix 08-08-27.06 - Caco 2008-08-28 13:59:58.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1592 [GMT -4:00]

Executando de: C:\Documents and Settings\Caco\Desktop\kOMBO.EXE.exe

* Criado um novo ponto de restauro

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

C:\Arquivos de programas\PCHealthCenter

C:\Arquivos de programas\PCHealthCenter\0.exe

C:\Arquivos de programas\PCHealthCenter\0.gif

C:\Arquivos de programas\PCHealthCenter\1.exe

C:\Arquivos de programas\PCHealthCenter\1.gif

C:\Arquivos de programas\PCHealthCenter\1.ico

C:\Arquivos de programas\PCHealthCenter\2.exe

C:\Arquivos de programas\PCHealthCenter\2.gif

C:\Arquivos de programas\PCHealthCenter\2.ico

C:\Arquivos de programas\PCHealthCenter\3.exe

C:\Arquivos de programas\PCHealthCenter\3.gif

C:\Arquivos de programas\PCHealthCenter\4.exe

C:\Arquivos de programas\PCHealthCenter\5.exe

C:\Arquivos de programas\PCHealthCenter\7.exe

C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr0.dat

C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr1.dat

C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions

C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions\Antispyware 2008 XP\as2008xp.exe

C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions\Antispyware 2008 XP\LOG\20080827080630718.log

C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions\Antispyware 2008 XP\LOG\20080827082420796.log

C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions\Antispyware 2008 XP\LOG\20080827191709875.log

C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions\Antispyware 2008 XP\LOG\20080827193146140.log

C:\Documents and Settings\Caco\Dados de aplicativos\Adobe\crc.dat

C:\update.exe

C:\WINDOWS\system32\AdggQXbc.ini

C:\WINDOWS\system32\AdggQXbc.ini2

C:\WINDOWS\system32\cbXPggGV.dll

C:\WINDOWS\system32\cbXQggdA.dll

C:\WINDOWS\system32\efcAPgfc.dll

C:\WINDOWS\system32\gsgxpz.dll

C:\WINDOWS\system32\ilwmmh.dll

C:\WINDOWS\system32\mmx31236.dll

C:\WINDOWS\system32\mx31236.dll

C:\WINDOWS\system32\ofudcawn.dll

C:\WINDOWS\system32\sjscwceg.ini

C:\WINDOWS\system32\tcbgscox.ini

C:\WINDOWS\system32\wigaqsme.dll

----- BITS: Sites possivelmente infetados -----

http://hqsextube08.com

((((((((((((((((((((((( Ficheiros criados de 2008-07-28 to 2008-08-28 ))))))))))))))))))))))))))))))))

2008-08-28 09:00 . 2008-08-28 10:58 69 --a------ C:\WINDOWS\NeroDigital.ini

2008-08-28 08:59 . 2008-08-23 09:28	<DIR>	d--h-----	C:\Documents and Settings\LogMeInRemoteUser\Modelos

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	d--------	C:\Documents and Settings\LogMeInRemoteUser\Meus documentos

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	dr-------	C:\Documents and Settings\LogMeInRemoteUser\Menu Iniciar

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	d--------	C:\Documents and Settings\LogMeInRemoteUser\Favoritos

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	dr-h-----	C:\Documents and Settings\LogMeInRemoteUser\Dados de aplicativos

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	d--h-----	C:\Documents and Settings\LogMeInRemoteUser\Configura‡äes locais

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	d--h-----	C:\Documents and Settings\LogMeInRemoteUser\Ambiente de rede

2008-08-28 08:59 . 2008-08-23 05:25	<DIR>	d--h-----	C:\Documents and Settings\LogMeInRemoteUser\Ambiente de impressÆo

2008-08-28 08:59 . 2008-08-28 13:39	<DIR>	d--------	C:\Documents and Settings\LogMeInRemoteUser

2008-08-28 06:04 . 2008-08-28 06:04 103,552 --a------ C:\WINDOWS\system32\gecwcsjs.dll

2008-08-28 00:09 . 2008-08-28 00:09 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\LogMeIn

2008-08-28 00:09 . 2008-05-28 12:32 87,352 --a------ C:\WINDOWS\system32\LMIinit.dll

2008-08-28 00:09 . 2008-05-28 12:33 83,288 --a------ C:\WINDOWS\system32\LMIRfsClientNP.dll

2008-08-28 00:09 . 2008-03-07 13:39 45,848 --a------ C:\WINDOWS\system32\drivers\LMIRfsDriver.sys

2008-08-28 00:09 . 2008-05-28 12:33 24,608 --a------ C:\WINDOWS\system32\LMIport.dll

2008-08-28 00:08 . 2008-08-28 00:09 <DIR> d-------- C:\Arquivos de programas\LogMeIn

2008-08-28 00:08 . 2008-08-28 00:08 1,024 --a------ C:\.rnd

2008-08-27 23:53 . 2008-08-27 23:53 <DIR> d-------- C:\Arquivos de programas\SymNetDrv

2008-08-27 19:55 . 2008-08-27 19:55 86 --a------ C:\WINDOWS\wininit.ini

2008-08-27 19:35 . 2008-08-25 18:48 3,262 --a------ C:\WINDOWS\system32\2.ico

2008-08-27 19:22 . 2008-08-27 19:22 4,608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys

2008-08-27 19:21 . 2008-08-27 19:32	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\Symantec

2008-08-27 19:21 . 2008-08-27 19:21	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\AdobeUM

2008-08-27 19:21 . 2008-08-27 19:32	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\Symantec

2008-08-27 19:21 . 2008-08-27 23:53	<DIR>	d--------	C:\Arquivos de programas\Symantec

2008-08-27 19:21 . 2008-08-27 23:55	<DIR>	d--------	C:\Arquivos de programas\Norton AntiVirus

2008-08-27 19:21 . 2008-08-28 06:11	<DIR>	d--------	C:\Arquivos de programas\Arquivos comuns\Symantec Shared

2008-08-27 19:21 . 2006-09-15 22:52 124,016 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS

2008-08-27 19:21 . 2006-09-15 22:52 91,904 --a------ C:\WINDOWS\system32\S32EVNT1.DLL

2008-08-27 19:18 . 2008-08-27 19:18 <DIR> d-------- C:\Arquivos de programas\MSA

2008-08-27 19:18 . 2008-08-26 17:23 167,424 --a------ C:\WINDOWS\system32\MSA.cpl

2008-08-27 19:18 . 2008-08-25 18:48 3,262 --a------ C:\WINDOWS\system32\1.ico

2008-08-27 08:06 . 2008-08-28 06:29 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\services

2008-08-27 08:01 . 2008-08-27 08:02 7,238 --a------ C:\wmcodec_update.exe

2008-08-27 08:00 . 2008-08-27 08:00	<DIR>	d--------	C:\WINDOWS\Elven Mists 2

2008-08-27 08:00 . 2008-08-27 08:00	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\Intenium

2008-08-26 22:11 . 2008-08-26 22:11	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\Thunderbird

2008-08-26 22:11 . 2008-08-26 22:11	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\Talkback

2008-08-26 22:11 . 2008-08-28 09:11	<DIR>	d--------	C:\Arquivos de programas\Mozilla Thunderbird

2008-08-26 20:45 . 2008-08-26 20:45 2,291,712 --a------ C:\WINDOWS\system32\TUKernel.exe

2008-08-26 20:36 . 2008-08-26 20:36 <DIR> d-------- C:\Arquivos de programas\PowerQuest

2008-08-26 20:30 . 2006-12-19 16:53 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll

2008-08-26 20:29 . 2008-08-26 20:29	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\TuneUp Software

2008-08-26 20:29 . 2008-08-26 20:48	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\TuneUp Software

2008-08-26 20:29 . 2008-08-26 20:39	<DIR>	d--------	C:\Arquivos de programas\TuneUp Utilities 2007

2008-08-26 20:29 . 2008-08-26 20:29	<DIR>	d--------	C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard

2008-08-26 20:28 . 2008-08-26 20:28	<DIR>	d--------	C:\Arquivos de programas\Arquivos comuns\Ahead

2008-08-26 20:28 . 2008-08-26 20:28	<DIR>	d--------	C:\Arquivos de programas\Ahead

2008-08-26 20:28 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll

2008-08-26 20:28 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll

2008-08-26 20:28 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll

2008-08-26 20:28 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

2008-08-26 20:28 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe

2008-08-26 20:28 . 2004-03-02 17:37 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys

2008-08-26 20:28 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll

2008-08-26 20:28 . 2004-03-02 17:37 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys

2008-08-26 20:27 . 2008-08-26 20:27	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\ACD Systems

2008-08-26 20:26 . 2008-08-26 20:26	<DIR>	d--------	C:\Arquivos de programas\ACD Systems

2008-08-25 18:44 . 2008-08-25 18:44	<DIR>	d--------	C:\Arquivos de programas\ReflexiveArcade

2008-08-24 19:01 . 2008-08-24 19:02	<DIR>	d--------	C:\WINDOWS\system32\Adobe

2008-08-24 18:13 . 2008-08-26 15:28	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\Skype

2008-08-24 18:13 . 2008-08-24 18:13	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\Skype

2008-08-24 18:13 . 2008-08-24 18:13	<DIR>	d--------	C:\Arquivos de programas\Skype

2008-08-24 18:13 . 2008-08-24 18:13	<DIR>	d--------	C:\Arquivos de programas\Arquivos comuns\Skype

2008-08-24 18:04 . 2008-08-27 23:54	<DIR>	d--------	C:\Jogos

2008-08-24 18:04 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll

2008-08-24 14:42 . 2008-08-24 14:42	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\Media Player Classic

2008-08-24 09:47 . 2008-08-24 09:47	<DIR>	d--------	C:\Arquivos de programas\PluginLetras

2008-08-24 08:46 . 2008-08-24 08:47	<DIR>	d--------	C:\Arquivos de programas\DAEMON Tools Toolbar

2008-08-24 08:46 . 2008-08-24 08:47	<DIR>	d--------	C:\Arquivos de programas\DAEMON Tools Lite

2008-08-24 00:29 . 2008-08-24 00:29	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\Adobe Systems

2008-08-24 00:29 . 2008-08-24 00:29	<DIR>	d--------	C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared

2008-08-24 00:29 . 2008-08-26 20:41	<DIR>	d--------	C:\Arquivos de programas\Arquivos comuns\Adobe

2008-08-24 00:25 . 2008-08-24 00:27	<DIR>	d--------	C:\Arquivos de programas\BitLord

2008-08-24 00:22 . 2008-08-24 08:50	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-08-24 00:22 . 2008-08-24 00:22	<DIR>	d--------	C:\Arquivos de programas\Spybot - Search & Destroy

2008-08-24 00:19 . 2008-08-24 00:19	<DIR>	d--------	C:\Documents and Settings\Caco\Dados de aplicativos\DAEMON Tools

2008-08-24 00:19 . 2008-08-24 00:20 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2008-08-24 00:16 . 2008-08-25 14:27	<DIR>	d--------	C:\Documents and Settings\Caco\Contacts

2008-08-24 00:16 . 2008-08-24 00:16	<DIR>	d--------	C:\Arquivos de programas\K-Lite Codec Pack

2008-08-23 23:04 . 2008-08-23 23:04 421 --a------ C:\WINDOWS\ODBC.INI

2008-08-23 23:03 . 2008-08-23 23:03	<DIR>	d--------	C:\WINDOWS\SHELLNEW

2008-08-23 23:03 . 2008-08-23 23:03	<DIR>	d--------	C:\Arquivos de programas\Microsoft Works

2008-08-23 23:03 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll

2008-08-23 23:01 . 2008-08-23 23:01	<DIR>	dr-h-----	C:\MSOCache

2008-08-23 22:15 . 2008-08-23 22:20	<DIR>	d--hsc---	C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-08-23 22:14 . 2008-08-23 22:14	<DIR>	d--------	C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-08-23 22:14 . 2008-08-23 22:20	<DIR>	d--------	C:\Arquivos de programas\Windows Live

2008-08-23 22:12 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll

2008-08-23 22:12 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui

2008-08-23 22:12 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui

2008-08-23 22:12 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui

2008-08-23 22:12 . 2007-07-30 19:18 20,824 --a------ C:\WINDOWS\system32\wuaueng.dll.mui

2008-08-23 22:07 . 2008-08-23 22:07 <DIR> d-------- C:\Arquivos de programas\Alwil Software

2008-08-23 22:07 . 2003-03-18 17:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll

2008-08-23 22:07 . 2003-03-18 16:14 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll

2008-08-23 22:07 . 2003-02-21 00:42 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll

2008-08-23 22:04 . 2008-08-23 22:04 0 --a------ C:\WINDOWS\nsreg.dat

2008-08-23 22:01 . 2008-08-23 22:01 <DIR> d-------- C:\Documents and Settings\Caco\Dados de aplicativos\Creative

2008-08-23 21:59 . 2000-05-22 04:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx

2008-08-23 21:59 . 1999-10-10 21:00 41,984 --------- C:\WINDOWS\Ctregrun.exe

2008-08-23 21:55 . 2008-08-23 21:55 <DIR> d-------- C:\WINDOWS\system32\Data

2008-08-23 21:54 . 2004-02-18 09:52 176,128 --a------ C:\WINDOWS\system32\USBAudio.cpl

2008-08-23 21:54 . 2004-03-25 09:21 135,168 --a------ C:\WINDOWS\system32\USBAudio.crl

2008-08-23 21:54 . 2003-12-17 15:59 46,731 --a------ C:\WINDOWS\system32\usbaudio.chm

2008-08-23 21:54 . 2003-04-01 19:38 692 --a------ C:\WINDOWS\system32\USBAudio.cpl.manifest

2008-08-23 21:53 . 2008-08-23 21:59 <DIR> d-------- C:\Arquivos de programas\Creative

2008-08-23 21:53 . 2003-03-05 12:19 15,840 --a------ C:\WINDOWS\system32\drivers\PfModNT.sys

2008-08-23 21:50 . 2008-08-23 22:01 <DIR> d-------- C:\WINDOWS\nview

2008-08-23 21:50 . 2007-04-19 14:14 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE

2008-08-23 21:50 . 2007-04-19 00:26 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe

2008-08-23 21:50 . 2008-08-28 11:30 88,723 --a------ C:\WINDOWS\system32\nvapps.xml

2008-08-23 21:50 . 2007-04-19 00:26 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu

2008-08-23 21:47 . 2008-08-23 21:47	<DIR>	d--------	C:\Arquivos de programas\JPEG Camera

2008-08-23 21:45 . 2008-08-23 21:45	<DIR>	d---s----	C:\Documents and Settings\Caco\UserData

 

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-08-27 00:37 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-08-27 00:36 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2008-08-23 13:42 315,392 ----a-w C:\WINDOWS\HideWin.exe

2008-08-23 13:42 --------- d-----w C:\Arquivos de programas\Realtek

2008-08-23 13:40 --------- d-----w C:\Arquivos de programas\Intel

2008-08-23 13:31 --------- d-----w C:\Arquivos de programas\microsoft frontpage

2008-08-23 13:30 --------- d-----w C:\Arquivos de programas\Serviços on-line

2008-08-23 13:29 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Serviços

2008-05-28 16:32 23,736 ----a-w C:\WINDOWS\system32\lmimirr.dll

2008-05-28 16:32 10,040 ----a-w C:\WINDOWS\system32\lmimirr2.dll

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

Nota entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

"BitComet"="C:\Arquivos de programas\BitLord\BitLord.exe" [2005-05-06 20:47 2224128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 00:26 7700480]

"LogMeIn GUI"="C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe" [2008-02-28 15:31 63048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2008-05-28 12:32 87352 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=ilwmmh.dll gsgxpz.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Acrobat Speed Launcher.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Acrobat Speed Launcher.lnk

backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\WINDOWS\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2091865e]

--a------ 2008-08-28 06:04 103552 C:\WINDOWS\system32\gecwcsjs.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

--a------ 2004-12-14 02:12 483328 C:\Arquivos de programas\Adobe\Acrobat 7.0\Distillr\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Antivirus]

--a------ 2008-08-26 17:22 416768 C:\Arquivos de programas\MSA\MSA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

--a------ 2007-02-21 16:50 58984 C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCAPP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]

--a------ 2003-09-17 10:43 57344 C:\Arquivos de programas\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

--a------ 2008-07-24 11:02 490952 C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

--a------ 2007-10-18 11:34 5724184 C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

--a------ 2007-04-19 00:26 7700480 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

--a------ 2007-04-19 00:26 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2007-07-02 17:10 23237416 C:\Arquivos de programas\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

-rahs---- 2008-07-07 09:42 2156368 C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]

--a------ 2004-11-04 14:59 218240 C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\usrprmpt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]

--a------ 2008-08-27 23:53 100056 C:\ARQUIV~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]

--------- 2000-05-11 01:00 90112 C:\WINDOWS\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

-r------- 2005-05-03 06:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

--a------ 2007-04-19 00:26 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

-r------- 2007-10-24 23:57 16855552 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

-r------- 2007-10-10 23:04 1826816 C:\WINDOWS\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Arquivos de programas\\BitLord\\BitLord.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"C:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 Agendador do LiveUpdate automático;Agendador do LiveUpdate automático;C:\Arquivos de programas\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-08-03 17:57]

R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Arquivos de programas\LogMeIn\x86\RaInfo.sys [2008-02-28 15:31]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 13:39]

R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:45]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l151x86.sys [2007-10-31 20:56]

R3 CAM1690;USB 2.0 Compliance JPEG Video Camera;C:\WINDOWS\system32\Drivers\cam1690.sys [2007-08-13 16:54]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

Conte£do da pasta 'Tarefas Agendadas'

2008-08-27 C:\WINDOWS\Tasks\1-Click Maintenance.job

C:\Arquivos de programas\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 16:53]

2008-08-28 C:\WINDOWS\Tasks\Norton AntiVirus - Verificar o meu computador - Caco.job

C:\ARQUIV~1\NORTON~1\Navw32.exe [2005-07-18 16:16]

- - - ORFAOS REMOVIDOS - - - -

SSODL-pdoskegl-{7E97518F-E349-485F-8031-F9C2ACE5F5E2} - C:\WINDOWS\pdoskegl.dll

MSConfigStartUp-Run - C:\Documents and Settings\Caco\Dados de aplicativos\Adobe\Manager.exe

MSConfigStartUp-s9201 - C:\Documents and Settings\All Users\Dados de aplicativos\Secure Solutions\Antispyware 2008 XP\as2008xp.exe

MSConfigStartUp-Waiting1690 - C:\Windows\stid1690.exe

------- Ccan Suplementar -------

FireFox -: Profile - C:\Documents and Settings\Caco\Dados de aplicativos\Mozilla\Firefox\Profiles\q8btqxig.default\

FF -: plugin - C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\browser\nppdf32.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-28 14:04:35

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

------------------------ Outros Processos em Execu‡Æo ------------------------

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCSETMGR.EXE

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\CTSVCCDA.EXE

C:\Arquivos de programas\LogMeIn\x86\ramaint.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\Norton AntiVirus\NAVAPSVC.EXE

C:\Arquivos de programas\Norton AntiVirus\IWP\NPFMNTOR.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCEVTMGR.EXE

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\WINDOWS\system32\taskmgr.exe

**************************************************************************

Tempo para conclusÆo: 2008-08-28 14:17:39 - Maquina reiniciou

ComboFix-quarantined-files.txt 2008-08-28 18:17:36

Pre-Run: 7 pasta(s) 92,694,446,080 bytes disponíveis

Post-Run: 10 pasta(s) 92,661,202,944 bytes dispon¡veis

328

*****************

Log do HijackThis:

Logfile of HijackThis v1.99.1

Scan saved at 14:19:40, on 28/8/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccSetMgr.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\Norton AntiVirus\navapsvc.exe

C:\Arquivos de programas\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Arquivos de programas\Arquivos comuns\Symantec Shared\ccEvtMgr.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe

C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Caco\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Arquivos de programas\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [bitComet] "C:\Arquivos de programas\BitLord\BitLord.exe"